medium5.4
CVE-2025-52896
Frappe is a full-stack web application framework.
Impact
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Frappe | Frappe | before 14.94.2 from 15.0.0 before 15.57.0 |